CVE-2026-119627
2026-11-01
09h48 +00:00
09h48 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Gitea limited-visibility profile disclosure with public-only tokens
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Insufficient Granularity of Access Control The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity |
